Conflicts:
- `config/initializers/content_security_policy.rb`:
Upstream added some code to add the Identity Provider's sign-in endpoint to
the `form-action` Content Security Policy directive but our version of the
file is pretty different.
Ported the change.
